Two tabs, matching Ed’s HA “Weather” dashboard:

Now — current conditions with needle gauges (Temperature, Humidity, Wind, UV, each with severity color bands), tiles for every Tempest metric (feels-like, dew point, wet bulb, air density, wind gust/lull/avg/direction, rain rate/type, solar irradiance, illuminance, barometric pressure, lightning + distance, battery), plus the NWS forecast (daily + hourly) at the top.

Trends — a 24h / 7d / 30d range selector:

• 24h — raw station readings (HA recorder history)
• 7d — hourly averages · 30d — daily averages — both from HA long-term statistics (permanent retention), with a temperature min/max band
• Charts: temperature (temp/feels/dew), humidity, barometric pressure, wind + gust, UV + solar, rain accumulation

Auto-refresh: conditions every 20s, forecast every 30 min, trends on demand.

All fetched server-side — no secrets in the page:

CT100 reaches farm HA over the house→farm NetBird route (the same path tempest-logger.py uses). The service authenticates to HA with a long-lived access token (HA → Profile → Security → Long-Lived Access Tokens), stored only in /etc/tempest-web.env.

• Service — dependency-free Python (http.server), stdlib only. Includes a small hand-rolled WebSocket client so it can pull HA long-term statistics directly.

• systemd — /etc/systemd/system/tempest-web.service (Restart=always, EnvironmentFile-style via /etc/tempest-web.env). Manage with systemctl status|restart tempest-web.

• Caddy — CT103 /etc/caddy/Caddyfile, inside the *.edmd.me wildcard block:

  @weather host weather.edmd.me
  handle @weather {
      reverse_proxy 192.168.8.100:8790
  }
  

  TLS is covered by the existing wildcard cert — no per-host cert needed. Reload with caddy reload --config /etc/caddy/Caddyfile.

• DNS — weather.edmd.me resolves to 192.168.8.54 (Caddy) locally and to Cloudflare publicly.

Endpoints: / (page) · /api/current · /api/history?range=24h|7d|30d · /api/forecast · /healthz.

• Restart — ssh pve pct exec 100 -- systemctl restart tempest-web
• Update code — edit ~/Sync/ED/homelab/tempest-web/tempest-web.py, copy to /opt/tempest-web/ on CT100, restart.
• Rotate the HA token — create a new LLAT in HA, set HA_TOKEN= in /etc/tempest-web.env, restart.
• Health — curl http://192.168.8.100:8790/healthz → ok / degraded.

Gotchas:

• If /api/current returns 401, the HA token in /etc/tempest-web.env is missing or expired.
• 7d/30d trends depend on farm HA reachability + the WebSocket path; 24h and current use plain REST and degrade independently.
• Separate pipeline: the station is also logged every 5 min to farmdb weather_observations by tempest-logger.py (used by the morning briefing). This dashboard is live-from-HA, not from that table.